{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-72284", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.917Z", "datePublished": "2026-08-15T05:55:07.765Z", "dateUpdated": "2026-08-17T05:42:19.282Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:42:19.282Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs\n\nIgnore KVM's internal \"service pending PV EOI\" request if the vCPU has\ndisabled PV EOIs since the request was made. Asserting that PV EOIs are\nenabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e.\nif pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables\nPV EOIs.\n\n kernel BUG at arch/x86/kvm/lapic.c:3338!\n Oops: invalid opcode: 0000 [#1] SMP\n CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm]\n Call Trace:\n \n kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm]\n kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\n __x64_sys_ioctl+0x8a/0xd0\n do_syscall_64+0xb5/0xb40\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \n Modules linked in: kvm_intel kvm irqbypass\n ---[ end trace 0000000000000000 ]---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The flaw is reached when malicious guest code in an x86 KVM VM races paravirtual EOI state, causing kvm_lapic_sync_from_vapic() to run on VM exit via KVM_RUN; this requires local guest execution on a KVM host, not remote network packets to the host kernel.\nAC:L - The attacker controls both sides of the race: guest wrmsr to MSR_KVM_PV_EOI_EN disables PV EOI while KVM_APIC_PV_EOI_PENDING remains set, then any VM exit reliably hits BUG_ON; optional guest memory unmapping can also force pv_eoi_get_user() failure without uncontrollable host timing.\nPR:N - No host root or init-namespace capabilities are required; exploitation needs only code execution inside an assigned KVM guest with KVM_FEATURE_PV_EOI (default on Linux/QEMU guests), typical for any cloud VM tenant without privileged host access.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own guest workload; triggering is fully automated via guest MSR writes and deliberate VM exits that drive the KVM_RUN return path.\nS:C - A guest-triggered BUG_ON in host KVM LAPIC code panics the physical host kernel and denies all co-resident VMs, crossing the guest-to-host KVM virtualization security boundary even though exploitation is denial-of-service rather than memory corruption.\nC:N - The failure mode is BUG_ON in apic_sync_pv_eoi_from_guest with no out-of-bounds access, use-after-free, or memory corruption; it is a deterministic assertion panic without an information disclosure or memory-read primitive.\nI:N - No guest-controlled kernel memory write or control-flow hijack occurs; the host kernel aborts via BUG_ON before any exploitable state mutation beyond crashing the host, and the bug is a stale pending-bit assertion not type confusion.\nA:H - BUG_ON in kvm_lapic_sync_from_vapic provokes a host kernel oops/panic during KVM_RUN VM-exit processing, immediately denying availability of the hypervisor and every VM on the affected x86 KVM host; the attack is repeatable while PV EOI remains enabled for the guest." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kvm/lapic.c" ], "versions": [ { "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb", "lessThan": "038b9ce6fafda1babd1e33d52cbc6039747a6d87", "status": "affected", "versionType": "git" }, { "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb", "lessThan": "8e9f7a95279bf608cf4c331ed89612e28c04564f", "status": "affected", "versionType": "git" }, { "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb", "lessThan": "ebd7845ca0471d251a1cb48d84eb165aff5b7123", "status": "affected", "versionType": "git" }, { "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb", "lessThan": "97542f15dc4cf6cd3fdc035e482dca54246ddf48", "status": "affected", "versionType": "git" }, { "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb", "lessThan": "32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e", "status": "affected", "versionType": "git" }, { "version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb", "lessThan": "9285e4070df2c40585c3d7ec9571faa7a2b97e17", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kvm/lapic.c" ], "versions": [ { "version": "3.6", "status": "affected" }, { "version": "0", "lessThan": "3.6", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.1.178" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.6.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.12.97" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.18.40" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.1.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/038b9ce6fafda1babd1e33d52cbc6039747a6d87" }, { "url": "https://git.kernel.org/stable/c/8e9f7a95279bf608cf4c331ed89612e28c04564f" }, { "url": "https://git.kernel.org/stable/c/ebd7845ca0471d251a1cb48d84eb165aff5b7123" }, { "url": "https://git.kernel.org/stable/c/97542f15dc4cf6cd3fdc035e482dca54246ddf48" }, { "url": "https://git.kernel.org/stable/c/32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e" }, { "url": "https://git.kernel.org/stable/c/9285e4070df2c40585c3d7ec9571faa7a2b97e17" } ], "title": "KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs", "x_generator": { "engine": "bippy-1.2.0" } } } }